CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 3734 | CVE-2001-0928 | Candidate | Buffer overflow in the permitted function of GNOME gtop daemon (libgtop_daemon) in libgtop 1.0.13 and earlier may allow remote attackers to execute arbitrary code via long authentication data. | Modified (20050511) | ACCEPT(2) Baker, Foat | MODIFY(1) Frech | NOOP(4) Armstrong, Christey, Cole, Wall | Frech> XF:XF:libgtop-permitted-bo(7635) | CONFIRM:MandrakeSoft Security Advisory MDKSA-2001:094, | "libgtop", | http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-094.php3 | CONFIRM:Debian Security Advisory DSA-098-1, "libgtop: format string | vulnerability and buffer overflow", | http://www.debian.org/security/2002/dsa-098 | Christey> BID:3594 | URL:http://www.securityfocus.com/bid/3594 | CONECTIVA:CLA-2002:448 | URL:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000448 | MANDRAKE:MDKSA-2001:094 | URL:http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-094.php3 | DEBIAN:DSA-098 | URL:http://www.debian.org/security/2002/dsa-098 | Christey> DEBIAN:DSA-301 | URL:http://www.debian.org/security/2003/dsa-301 | View |
| 3956 | CVE-2001-1152 | Candidate | Baltimore Technologies WEBsweeper 4.02, when used to manage URL blacklists, allows remote attackers to bypass blacklist restrictions and connect to unauthorized web servers by modifying the requested URL, including (1) a // (double slash), (2) a /SUBDIR/.. where the desired file is in the parentdir, (3) a /./, or (4) URL-encoded characters. | Proposed (20020315) | ACCEPT(2) Baker, Foat | MODIFY(1) Frech | NOOP(4) Armstrong, Cole, Green, Wall | REJECT(1) Ziese | Ziese> ACCEPT REASON: Rejection logic makes sense, products have to be used as | intended. Misuse is not a security vulnerability per se. | Frech> XF:content-slash-bypass-filter(6816) | Baker> I would say that this is a vulnerability, since their website | touts URL filtering as a feature of the product. If the product has to | filter URL"s then the product needs to be able to filter URL"s properly, | or the product fails. | Here is the list of features, quoted from their product page for | web sweeper: | | "Key Features | Policy based web security implementation for information posted to and downloaded from the web | Protects against unauthorized users accessing the web utilizing user authentication | Provides URL filtering blocking stopping inappropriate site access | Protects against loss of confidential information, viruses, portable code, and inappropriate content entering and | leaving via web based e-mail accounts such as hotmail and Yahoo | Auditing and reporting on individual and group web traffic | Customizable "Block" and "Progress Message" pages " | View |
| 4632 | CVE-2002-0240 | Candidate | PHP, when installed with Apache and configured to search for index.php as a default web page, allows remote attackers to obtain the full pathname of the server via the HTTP OPTIONS method, which reveals the pathname in the resulting error message. | Proposed (20020502) | ACCEPT(2) Baker, Frech | MODIFY(1) Cox | NOOP(4) Armstrong, Cole, Foat, Wall | CHANGE> [Cox changed vote from REVIEWING to MODIFY] | Cox> Change to "....installed with Apache 2.0 for Windows" | View |
| 332 | CVE-1999-0333 | Candidate | HP OpenView Omniback allows remote execution of commands as root via spoofing, and local users can gain root access via a symlink attack. | Modified (19990925-01) | ACCEPT(2) Baker, Frech | MODIFY(1) Prosser | RECAST(1) Christey | Prosser> additional source | HP Security Bulletin 85 | http://us-support.external.hp.com | http://europe-support.external.hp.com | Christey> Two separate bugs, so SF-LOC says this candidate should be | split | Christey> ADDREF CIAC:J-007 | URL:http://ciac.llnl.gov/ciac/bulletins/j-007.shtml | View |
| 253 | CVE-1999-0254 | Candidate | A hidden SNMP community string in HP OpenView allows remote attackers to modify MIB tables and obtain sensitive information. | Proposed (19990726) | ACCEPT(2) Baker, Frech | NOOP(1) Wall | REVIEWING(1) Christey | Christey> What is the proper level of abstraction to use here? Should | we have a separate entry for each different default community | string? See: | http://cve.mitre.org/Board_Sponsors/archives/msg00242.html and | http://cve.mitre.org/Board_Sponsors/archives/msg00250.html | http://cve.mitre.org/Board_Sponsors/archives/msg00251.html | | Until the associated content decisions have been approved | by the Editorial Board, this candidate cannot be accepted | for inclusion in CVE. | View |
Page 783 of 20943, showing 5 records out of 104715 total, starting on record 3911, ending on 3915
